From: Yonghong Song <yonghong.song@linux.dev>
To: David Windsor <dwindsor@gmail.com>,
bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>
Cc: Martin KaFai Lau <martin.lau@linux.dev>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Song Liu <song@kernel.org>, Jiri Olsa <jolsa@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Stanislav Fomichev <sdf@fomichev.me>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH bpf-next] bpf: reject sleepable BPF_LSM_CGROUP programs at load time
Date: Fri, 5 Jun 2026 11:15:54 -0700 [thread overview]
Message-ID: <feeb60d5-8158-4d80-84cb-ed28c292a2fd@linux.dev> (raw)
In-Reply-To: <20260605145707.608579-1-dwindsor@gmail.com>
On 6/5/26 7:57 AM, David Windsor wrote:
> The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should
> not attach any sleepable BPF programs there. Add support to the verifier
> to explicitly reject attempts to load sleepable BPF programs destined
> for LSM cgroup attachment.
>
> Without this, we get the following splat from a BPF_LSM_CGROUP
> program marked BPF_F_SLEEPABLE attached to file_open when it calls
> bpf_get_dentry_xattr():
>
> BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567
> in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load
> preempt_count: 0, expected: 0
> RCU nest depth: 2, expected: 0
> Call Trace:
> down_read+0x76/0x480
> ext4_xattr_get+0x11f/0x700
> __vfs_getxattr+0xf0/0x150
> bpf_get_dentry_xattr+0xbb/0xf0
> bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85
> __cgroup_bpf_run_lsm_current+0x326/0x840
> bpf_trampoline_6442534646+0x62/0x14d
> security_file_open+0x34/0x60
> do_dentry_open+0x340/0x1260
> vfs_open+0x7a/0x440
> path_openat+0x1bac/0x30a0
>
> libbpf provides a .s named section variant for every sleepable
> program type except lsm_cgroup, reflecting that per-cgroup LSM programs
> are intended to only run in a non-sleepable context.
>
> The above splat was obtained by bypassing libbpf by using bpf(2)
> directly.
>
> Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
> Signed-off-by: David Windsor <dwindsor@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
next prev parent reply other threads:[~2026-06-05 18:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-05 14:57 [PATCH bpf-next] bpf: reject sleepable BPF_LSM_CGROUP programs at load time David Windsor
2026-06-05 18:15 ` Yonghong Song [this message]
2026-06-05 21:40 ` Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=feeb60d5-8158-4d80-84cb-ed28c292a2fd@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=dwindsor@gmail.com \
--cc=eddyz87@gmail.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox